From 037af6890fe6fdb84a08d3c86083e847c90ec0ad Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Tue, 22 Oct 2013 08:17:26 -0400
Subject: [PATCH] Fix vulnerability in handling _session argument of utils/save-prefs (#1489382)
---
plugins/password/drivers/virtualmin.php | 8 ++++----
1 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/plugins/password/drivers/virtualmin.php b/plugins/password/drivers/virtualmin.php
index 69f1475..d2b765a 100644
--- a/plugins/password/drivers/virtualmin.php
+++ b/plugins/password/drivers/virtualmin.php
@@ -48,10 +48,10 @@
$pieces = explode("_", $username);
$domain = $pieces[0];
break;
- case 8: // domain taken from alias, username left as it was
- $email = $rcmail->user->data['alias'];
- $domain = substr(strrchr($email, "@"), 1);
- break;
+ case 8: // domain taken from alias, username left as it was
+ $email = $rcmail->user->data['alias'];
+ $domain = substr(strrchr($email, "@"), 1);
+ break;
default: // username@domain
$domain = substr(strrchr($username, "@"), 1);
}
--
Gitblit v1.9.1